CVE-2026-123088: UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

Q: Which deployments are exposed?

Sites using UniPAY Payment Gateway For WooCommerce versions before 2.4 are affected. The issue is reachable without authentication.

Q: What does an attacker need to exploit this?

An attacker only needs to supply order IDs to obtain order-received URLs. No authorization check is performed before the URL is returned.

Q: What information can be disclosed?

The redirect exposes the order's secret key, which can enable disclosure of the customer's name, email address, phone number, and address.

Q: How can exposure be identified?

Verify the installed UniPAY Payment Gateway For WooCommerce version. Versions earlier than 2.4 should be treated as vulnerable.

Published Nov 9, 2026

Updated

The UniPAY Payment Gateway For WooCommerce WordPress plugin before 2.4 does not perform any authorization check before returning an order's order-received URL for an attacker-supplied order id, exposing the order's secret key in the redirect and allowing unauthenticated attackers to enumerate orders and disclose customers' personal data (name, email address, phone number and address).

Affected Software

1 affected component

UniPAY UniPAY Payment Gateway For WooCommerce WordPress plugin<2.4

Event History

Nov 9, 2026

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

DescriptionWeakness

Data Sourced

via NVD·07:17 AM

Description

Frequently Asked Questions

Which deployments are exposed?

Sites using UniPAY Payment Gateway For WooCommerce versions before 2.4 are affected. The issue is reachable without authentication.

What does an attacker need to exploit this?

An attacker only needs to supply order IDs to obtain order-received URLs. No authorization check is performed before the URL is returned.

What information can be disclosed?

The redirect exposes the order's secret key, which can enable disclosure of the customer's name, email address, phone number, and address.

How can exposure be identified?

Verify the installed UniPAY Payment Gateway For WooCommerce version. Versions earlier than 2.4 should be treated as vulnerable.

CVE-2026-123088: UniPAY Payment Gateway For WooCommerce < 2.4 - Unauthenticated Order Key and Customer PII Disclosure

Affected Software

Event History

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What information can be disclosed?

How can exposure be identified?

Company

Resources

Contact

Frequently Asked Questions

Which deployments are exposed?

What does an attacker need to exploit this?

What information can be disclosed?

How can exposure be identified?